Yes, in your screenshot example it works because your pie chart is large.  Reduce the size of the pie chart and you'll notice how fields start to disappear.  This is even more apparent when one or multiple fields are much larger values than all of the others.  This happens to me even if you change the "Minimum Size" = 0.   ... View more

This worked for me.  My pie chart was just one of a few panels in a dashboard's row.  When I would open that panel search on its own, even fields with small values would be shown because it was a pie chart in its own "row".  Moving my pie chart into its own dashboard row and making it larger then showed small values in the visualization.  Sadly, I have not found any other changes to the visualization settings, search parameters/settings, that would force a small pie chart to show all fields that have small values.  Quite annoying. ... View more

Thanks for this!  This worked for me in 9.1.2.  Definitely nicer than my thought of grepping for the index  name recursively from all /opt/splunk/etc/apps/search and /opt/splunk/etc/users. ... View more

Of all the searches I've done, this REST search was the only one that worked for me in 9.0.0.  I tweaked it to give me client per server class so that I could export a csv of my environment.  The only caveat is that it won't include any server classes that don't have any clients phoned home, which is a minor issue.  Note: this must be run from Deployment Server (DS). | rest /services/deployment/server/clients count=0 splunk_server=local | table hostname serverClasses.*.stateOnClient | untable hostname ServerClassNames dummy | rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" | stats values(hostname) as hostname dc(hostname) by ServerClassNames | rename hostname as clientName | table ServerClassNames, clientName   ... View more

Thank you, @PaveIP. I verified again that Server A and Server B both have the same time and time zone. If they were different, we would have other application issues besides Splunk. I also performed the index=_internal host=serverB ntp* OR adjust search for the past 30 days against both Server A and Server B and received no results. ... View more

Here you go, I have to obfuscate some of the event date: [props_stanza_in_question] CHARSET = UTF-8 MAX_TIMESTAMP_LOOKAHEAD = 23 FIELDALIAS-IP = IP AS src_ip SEDCMD-remove = s/(\s{3}at.)|(\n\s+---\s.)|(\nServer stack trace:)|(\nException\s\w+\s.*:)//g SEDCMD-spaces = s/[\n\r]+//g SEDCMD-nullblock = s/(XXX(Xxxxx=(null):(null)\,PosId=(null):(null)\,IP=(null))\ InitialTrans(ID=(null)\,\ SEQ=(null)))/SED-nb/g TRANSFORMS-Combined = transform_ak_f2p,transform_ak_ce,transform_ak_all TRANSFORMS-Type_Fields = extract_type TRANSFORMS-Level_Fields = extract_level TRANSFORMS-Message_Fields = extract_message Event: 2020-05-12 13:05:47,817 [Upload7] ERROR (xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.FallbackMessageXmlQueueHandler) SED-nb Failed to persists message to xxxx xxxx saving 1 Message Xmls to DB. Error Message: The xxxx operation was interrupted: xxxx close-reason, initiated by Library, code=541, text="Unexpected Exception", classId=0, methodId=0, cause=System.Net.Sockets.SocketException (0x80004005): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond Fields: _time = 2020-05-12T08:05:47.817-05:00 date_hour = 13 date_mday = 12 date_minute = 5 date_month = may date_second = 47 date_wday = tuesday date_year = 2020 date_zone = local ... View more

The problem I'm experiencing is that _time is the field that is unreliable here, not date_hour. ... View more